Put the dependency and license audit on a schedule
An audit that runs when somebody remembers, moved onto a schedule that opens work the day an advisory lands.
The ticket
Run the dependency and license audit on a schedule and route its findings to an owner.
Acceptance criteria
- The audit runs on a schedule independent of pull requests
- Findings are routed to a named owner or rotation
- New advisories open a ticket automatically
- Known accepted findings are recorded with a reason and a review date
What lands as proof
A scheduled run producing a routed, owned ticket, which is what turns an audit into work that happens.
Why teams defer it
- On-demand audits run after incidents, which is the wrong end of the timeline.
- Findings with no owner become a permanent list that everybody has learned to scroll past.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: run the dependency and license audit on a schedule and route its findings to an owner. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means a scheduled run opens work the day an advisory lands, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops for the plan, and the review bar is raised afterwards so that smaller suggestions block the merge too, not only serious findings.